Privacy Policy

Information provided pursuant to Art. 12 et seq. EU GDPR

The data controller under the EU General Data Protection Regulation (“GDPR”) and other applicable data protection legislation is:

ENA – European Nurserystock Association npo

Kortrijksesteenweg 1144J

B-9051 Sint-Denijs-Westrem, Belgium

Email: ena@enaplants.eu

This website is part of the “Green Heroes Europe” campaign, co-funded by the European Union. It is operated on behalf of ENA by GOPA Com. S.A., Bd de Waterloo 72, 1000 Brussels, Belgium, acting as implementing body of the campaign and as processor on behalf of the controller.

For any question about this policy, or to exercise the rights described in section 8, you can write to ena@enaplants.eu.

We process your personal data only to the extent necessary to provide a functioning website, our content and our services.

Where we have obtained your consent, the legal basis is Art. 6(1)(a) GDPR.

Where processing is necessary to perform a contract or to take steps at your request before entering into one, the legal basis is Art. 6(1)(b) GDPR.

Where processing is necessary to meet a legal obligation, the legal basis is Art. 6(1)(c) GDPR.

Where processing is necessary to protect our legitimate interests or those of a third party, and your interests and fundamental rights do not override them, the legal basis is Art. 6(1)(f) GDPR.

Your personal data is deleted as soon as the purpose for storing it no longer applies, or when you withdraw a consent on which the processing was based. The retention period that applies to each processing activity is given in section 4. Data may be kept longer where European or national law requires it. In those cases the data is blocked instead of used.

The “Green Heroes Europe” campaign runs until 31 December 2028. At the end of the campaign the website will be taken offline and the personal data collected through it will be deleted, including the data held in our web analytics account.

This policy does not apply to websites we link to. We recommend that you read the privacy policy of any external website you visit.

When you visit this website, we process the data your browser sends, so that the site can be displayed correctly on your device and so that our systems remain stable and secure. Part of this data is stored temporarily in log files.

The following data is processed: IP address, date and time of access, pages requested, the website you came from where applicable, the browser you use, and the operating system you use.

Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

Purpose: to deliver the website, keep it working and keep the systems used for it secure. This purpose is also our legitimate interest.

Retention: log files are kept for 7 days. Data processed to display the site is kept for the duration of your visit. Server backups may still contain this data for about 4 weeks, after which they are overwritten.

Objection: this processing is necessary to run the website, so there is no option to object.

This website uses cookies, which are small text files stored on your device by your browser. The first time you visit the site, a consent banner lets you accept or refuse the cookies that are not technically necessary.

4.2.1 Technically necessary cookies

Some functions of this website do not work without cookies, for example storing your language choice and your cookie preferences. A list of the technically necessary cookies we use, with their purpose and their retention period, is available in our cookie banner.

Legal basis: Art. 126 of the Belgian Electronic Communications Act in combination with Art. 6(1)(f) GDPR.

Purpose: to provide the functions and services of the website. This purpose is also our legitimate interest.

Retention: generally for the duration of your visit, unless stated otherwise in the cookie banner.

Objection: these cookies are stored on your device, so you remain in control. You can deactivate or restrict cookies in your browser settings and delete stored cookies at any time. If you deactivate cookies for this website, some functions may no longer work.

4.2.2 Cookies that are not technically necessary

These cookies are only used if you accept them in the cookie banner. They cover the services described in sections 4.4, 4.5 and 4.6. The banner lists the services concerned, the cookies they set, their purpose and their retention period.

Legal basis: consent, Art. 126 of the Belgian Electronic Communications Act in combination with Art. 6(1)(a) GDPR.

4.2.3 Record of your consent and withdrawal

We keep a record of the consent you give or refuse, so that we can demonstrate compliance. This record is kept for 12 months.

You can change or withdraw your choice at any time through the cookie settings link in the footer of this website, or by deleting the cookies in your browser. Withdrawing your consent does not affect the lawfulness of the processing carried out before the withdrawal.

Legal basis for the record: legitimate interest, Art. 6(1)(f) GDPR.

This website has a contact form. You can also write to us directly by email.

The following data is processed: name, email address and the content of your message.

Legal basis: legitimate interest, Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR where your request relates to a contract.

Purpose: to handle and answer your request.

Retention: 12 months after your request has been dealt with, unless longer statutory retention periods apply.

Objection: you can object to this processing at any time by writing to us. In that case we will no longer be able to deal with your request, and the correspondence will be deleted unless statutory retention periods prevent it.

With your consent, this website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how visitors use the site.

The following data is processed: IP address, the browser you use, the operating system you use, the pages you visit, and the time and duration of your visit. IP anonymisation is activated on this website, so your IP address is shortened before being stored.

Legal basis: consent, Art. 126 of the Belgian Electronic Communications Act in combination with Art. 6(1)(a) GDPR.

Purpose: to understand how the website is used, so that we can improve its content and structure.

Recipient: Google Ireland Limited, with possible transfer to Google LLC in the United States. See section 7.

Retention: 14 months in our Google Analytics account. We have no influence over how long Google itself keeps data. For more information see https://policies.google.com/privacy.

Withdrawal: you can withdraw your consent at any time through the cookie settings link in the footer of this website, or by changing your browser settings so that cookies are refused or deleted.

This website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager does not collect personal data by itself. It is a tool we use to manage the tracking codes of the services described in this policy, and it only activates those services once you have accepted them in the cookie banner.

The following data is processed: IP address, technical connection data such as date and time, and device data.

Legal basis: consent, Art. 126 of the Belgian Electronic Communications Act in combination with Art. 6(1)(a) GDPR.

Purpose: to manage the tracking codes used on this website.

Recipient: Google Ireland Limited, with possible transfer to Google LLC in the United States. See section 7.

Retention: your data is processed for the duration of your visit only. We have no influence over how long Google itself keeps data. For more information see https://policies.google.com/privacy.

Withdrawal: through the cookie settings link in the footer of this website.

This website embeds videos hosted on YouTube, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The videos are embedded in privacy-enhanced mode, which means that YouTube does not store cookies for advertising purposes unless you play a video. Even so, when a video is loaded YouTube receives your IP address and information about your device, and may set cookies. For this reason the videos are only loaded after you have accepted them in the cookie banner.

Legal basis: consent, Art. 126 of the Belgian Electronic Communications Act in combination with Art. 6(1)(a) GDPR.

Purpose: to show campaign video content on our pages.

Recipient: Google Ireland Limited, with possible transfer to Google LLC in the United States. See section 7.

Retention: we do not store this data ourselves. For information on how Google keeps it, see https://policies.google.com/privacy.

Withdrawal: through the cookie settings link in the footer of this website.

This website uses Google reCAPTCHA, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to tell human visitors apart from automated requests and to protect our forms from abuse. The service runs in the background and does not require any action from you. When it runs, Google receives your IP address and information about how you interact with the page.

Legal basis: legitimate interest, Art. 6(1)(f) GDPR. Our legitimate interest is to protect the website and our forms against spam and misuse. Without this protection we would not be able to offer the contact form.

Purpose: to prevent automated abuse of our forms.

Recipient: Google Ireland Limited, with possible transfer to Google LLC in the United States. See section 7.

Retention: we do not store this data ourselves. For information on how Google keeps it, see https://policies.google.com/privacy.

Objection: you can object to this processing at any time by writing to us. In that case you can still contact us by email instead of using the form.

The campaign is also present on the YouTube and Instagram channels of ENA. When you visit or interact with these channels, the platform processes your personal data under its own privacy policy and as its own controller. We have no influence over that processing and no access to the data behind it, beyond the statistics the platforms make available to channel owners in aggregated form.

Where we process personal data you send us through these channels, for example a message or a comment, the legal basis is our legitimate interest in communicating about the campaign, Art. 6(1)(f) GDPR.

The privacy policies of the platforms are available at:

• YouTube: https://policies.google.com/privacy
• Instagram: https://privacycenter.instagram.com/policy

We only share personal data where this is necessary for the purposes described above and where a legal basis applies. The recipients are:

• GOPA Com. S.A., as implementing body of the campaign and processor acting on behalf of the controller
• our hosting provider, DigitalOcean, whose servers for this website are located in Frankfurt, Germany
• Google Ireland Limited, for web analytics, tag management, embedded videos and form protection
• where necessary, our IT service providers, lawyers, tax advisors and courts

Our service providers act as processors on our behalf under a data processing agreement, unless indicated otherwise.

The servers used for this website are located in the European Union. However, DigitalOcean is a company established in the United States, and the services provided by Google may involve a transfer of data to Google LLC in the United States.

Where personal data is transferred outside the European Economic Area, the transfer takes place on the basis of an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework where the recipient is certified under it, or on the basis of the Standard Contractual Clauses adopted by the European Commission.

You have the following rights in relation to your personal data:

1. Right of access. You can ask us whether and which personal data of yours we process, and receive information about the purposes, the categories of data, the recipients, the retention period, the origin of the data where we did not obtain it from you, and your further rights.
2. Right to rectification. You can ask us to correct or complete your data if it is inaccurate or incomplete.
3. Right to restriction of processing. You can ask us to restrict processing while we verify the accuracy of your data, if the processing is unlawful, if you need the data to pursue legal claims, or while we review an objection you have made.
4. Right to erasure. You can ask us to delete your data, in particular if we no longer need it, if you withdraw your consent and there is no other legal basis, if you object and there are no overriding grounds, or if the processing is unlawful.
5. Right to be informed. If you have exercised your right to rectification, erasure or restriction, we will inform the recipients of your data accordingly.
6. Right to data portability. You can ask to receive the data you have provided to us on the basis of consent or a contract in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where this is technically feasible.
7. Right to object. On grounds relating to your particular situation, you can object to processing based on our legitimate interest. We will then stop processing your data unless we can demonstrate compelling legitimate grounds.
8. Right to withdraw consent. You can withdraw a consent you have given at any time. This does not affect the lawfulness of the processing carried out before the withdrawal.

To exercise these rights, please write to the address given in section 2.

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. The competent authority for the controller is:

Gegevensbeschermingsautoriteit / Autorité de protection des données

Drukpersstraat 35 / Rue de la Presse 35

1000 Brussels, Belgium

contact@apd-gba.be

https://www.dataprotectionauthority.be

Version 1.0, October 2026. The English version of this policy is the reference version.